On 24 June, Beltug and sister CIO associations Cigref (France), CIO Platform (Netherlands) and VOICE (Germany) met with the European Commission’s Renate Nikolay, Deputy Director-General for Communications Networks, Content and Technology. On the agenda were the Data Act and the Digital Markets Act (DMA), and their impact on fair practices in cloud services and digital markets. This engagement with the European Commission underscores the importance of the sister associations’ advocacy for equitable and transparent regulations in the digital economy.
10 / 09 / 24
In June 2022, the sister associations jointly published 11 fair principles for software to improve the imbalance between cloud providers and their business customers. The current situation of unacceptable market practices by Broadcom/VMware clearly demonstrates the need for a strong approach by the European Commission in the cloud market to ensure fair practices in cloud services .
In the meeting with Renate Nikolay, the focus revolved around two main areas: the protection offered under Article 13 of the Data Act and the regulatory potential of the DMA in the cloud services market.
Article 13 of the Data Act (‘Unfair contractual terms unilaterally imposed on another enterprise’) is designed to protect customers from unfair contractual terms. At the meeting, the associations highlighted the critical need for Article 13 to apply to all contractual terms related to data access and usage, particularly those concerning the liability of cloud providers for unauthorised access to customer data.
The associations expressed concerns about the current state of cloud service contracts, where liability terms are often heavily skewed in favour of providers. At first glance, both the provider and the customer are liable for breaches of confidentiality: the provider must ensure confidentiality of the data that the customer stores at the provider, whereas the customer needs to maintain confidentiality of the contract itself. However in reality, liability terms are heavily unbalanced. For example, customers are frequently subject to unlimited liability for data breaches, while providers’ liability is capped at a much lower level, typically the annual service fee. This imbalance places undue risk on business users, making it imperative that Article 13 is interpreted and enforced in a way that offers robust protection against such unfair practices.
The associations called on the European Commission to clarify that Article 13 is context-neutral and should cover all relevant aspects of cloud contracts. Such clarification would empower business users to challenge and invalidate unfair terms, thereby fostering a more equitable digital marketplace.
There is growing debate over the extent of the legal rights surrounding the training of current large AI models on open-source and/or IP-protected data. A major concern is the potential unauthorised access to clients’ sensitive information, whether by third parties or by the service providers themselves.
In an era where a company’s success increasingly depends on its ability to capitalise on AI advancements, confidential and sensitive customer data held by cloud service providers represents a ‘goldmine’ of value. Safeguarding companies and public organisations from unauthorised access to this sensitive information is critical to maintain trust and ensure data privacy.
The growing reliance on a small number of very large cloud providers is equally concerning. During the meeting, the associations urged the European Commission to expedite the classification of cloud services under the DMA. This classification is vital for ensuring a fair and competitive market, especially as cloud services become increasingly central to business operations and innovation, including the development of AI.
The meeting with Renate Nikolay was a significant step in the sister associations’ continued efforts to advocate for fair practices in the digital market. By addressing key concerns related to the Data Act and DMA, the associations continue to advocate for the interests of business users at the highest levels. The associations remain committed to working closely with the European Commission to ensure that these legislative frameworks are implemented in ways that address the concerns of business users in the ongoing regulatory processes.